← Back

CVE-2026-34926

nvd nist
Published: May 21, 2026Modified: Jul 23, 2026CISA KEV

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Exploitability: 0.8 / Impact: 5.3
Source: security@trendmicro.com (Secondary)

Description

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability.

Affected (2)

Products: Trendmicro: Apex One
Trendmicro
1 product
Apex One
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Trendmicro
Apex One
Before 14.0.0.17079
Apex One
Before 14.0.20731

Related CWEs

CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (5)

Source: security@trendmicro.com
Third Party Advisory
Source: security@trendmicro.com
Vendor Advisory
Source: security@trendmicro.com
Vendor Advisory
Source: security@trendmicro.com
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.